Details on 14,450 patients at Ajax-Pickering site as well as Centenary were revealed to RESP company.

Tanya Taylor, received a second letter from Rouge Valley hospital yesterday letting her know even more of her personal info may have been leaked by hospital staffers after she gave birth to Taylor Brown, now 3, at the Ajax-Pickering site in 2010.

First it was her social insurance number and student loan balance, stored on a federal government hard drive that went missing in 2012.

Next it was her name, address and phone number, allegedly sold to private RESP companies by two employees at the hospital where she gave birth to her second daughter.

On Tuesday, Tanya Taylor learned her health card number may have been leaked from a second hospital — another piece of her privacy chipped away.

“This has happened to me three times now: my information has been sold or misplaced,” said the Scarborough mother of four in exasperation. “Why is this happening to me?”

Taylor is one of 14,450 patients of Rouge Valley Health System — predominantly new mothers — who have now been told their personal information may have been accessed by two former hospital staffers for the purpose of selling the parents RESPs.

Patients of Rouge Valley Centenary were first notified of the breach by mail in December 2013.

Now the health network says patients at Centenary’s sister campus, Rouge Valley Ajax and Pickering, are also affected.

Taylor, who gave birth at both hospitals, said she was upset to learn of the second breach.

“At first I was so shocked, because I thought it was over,” said Taylor, 33.

The letter said Taylor’s personal information, including her name, address, phone number, health card number, and the gender, name and date of birth of her daughter, may have been accessed.

“If the wrong person gets this information they could do a lot of damage. They could try to defraud me. They could try to get certain loans in my name. It’s very stressful,” Taylor said.

The letter says that while health card numbers may have been accessed, there is no evidence they were distributed. Taylor’s letter advises concerned patients contact Service Ontario to get a new health card.

The latest revelations affect mothers who gave birth at the Ajax and Pickering campus between July 9, 2009, and April 5, 2014, said Rouge Valley spokesman David Brazeau.

“The hospital is working with the Office of the Information and Privacy Commissioner and the Ontario Securities Commission, who have active investigations on this matter,” Brazeau said in an email.

“The hospital has no further comment as these investigations continue.”

According to Ontario’s privacy watchdog, 6,150 patients at Ajax and Pickering may have been affected, in addition to the 8,300 patients at Centenary.

“The two hospitals share an electronic information system to which the two employees who have been identified as responsible for the breach had access,” said acting privacy commissioner Brian Beamish in an email.

The two hospital staffers no longer work for Rouge Valley Health System.

Beamish said the privacy commissioner’s office plans to release the findings of its ongoing investigation this fall.

Lawyer Michael Crystal, who launched a $412-million class action lawsuit on behalf of the Centenary patients, said he expects the filing will be expanded to include the Ajax and Pickering patients. The lawsuit has not yet been certified.

In another privacy breach, Rouge Valley said a baby photography service working in the birthing centre of both Centenary and Ajax and Pickering was inappropriately provided a daily list of information about new mothers, which included the patients’ name, room number, age, gender, physician name and length of stay in hospital, and in some cases type of diet, type of room accommodation in hospital, and reason for admission to hospital.

“The list was only used to approach new mothers in the hospital to offer photography services. It was not used for any other purpose and it was not provided to any third party. The list never left the hospital, and it was shredded by the photographer,” reads a notice to patients on the Rouge Valley website.

The breach affects patients of the Centenary birthing centre between November 2009 and July 2014, and patients of the Ajax and Pickering maternal unit between April and July 2014.

Joel Eastwood can be reached at 647-232-6808.

More on thestar.com

We value respectful and thoughtful discussion. Readers are encouraged to flag comments that fail to meet the standards outlined in our
Community Code of Conduct.
For further information, including our legal guidelines, please see our full website
Terms and Conditions.